From eb04287396080805135768bb508f7b00fd65f40c Mon Sep 17 00:00:00 2001 From: Howard Enos Date: Thu, 9 Jul 2026 20:15:28 -0700 Subject: [PATCH] sync: auto-sync from HOWARD-HOME at 2026-07-09 20:14:58 Author: Howard Enos Machine: HOWARD-HOME Timestamp: 2026-07-09 20:14:58 --- ...9-howard-dortega-ad-account-printer-740.md | 167 ++++++++++++++++++ errorlog.md | 4 + wiki/clients/cascades-tucson.md | 4 +- 3 files changed, 174 insertions(+), 1 deletion(-) create mode 100644 clients/sif-oidak/session-logs/2026-07/2026-07-09-howard-dortega-ad-account-printer-740.md diff --git a/clients/sif-oidak/session-logs/2026-07/2026-07-09-howard-dortega-ad-account-printer-740.md b/clients/sif-oidak/session-logs/2026-07/2026-07-09-howard-dortega-ad-account-printer-740.md new file mode 100644 index 00000000..8cff5a25 --- /dev/null +++ b/clients/sif-oidak/session-logs/2026-07/2026-07-09-howard-dortega-ad-account-printer-740.md @@ -0,0 +1,167 @@ +# 2026-07-09 — Sif-oidak: dortega AD account, printer error 740, UPN decision + +## User +- **User:** Howard Enos (howard) +- **Machine:** Howard-Home +- **Role:** tech + +## Session Summary + +Howard reported that Dwayne Ortega could not log in to his machine at Sif-oidak District. Investigation via GuruRMM against the domain controller found no on-prem AD account matching `ortega` or `dwayne` among the 71 domain users. Ortega existed only as an M365 cloud user, created 2026-06-03. `dsregcmd` on Sif-Laptop554 showed the workstations are `DomainJoined: YES` / `AzureAdJoined: NO`, so an M365 credential can never authenticate a Windows sign-in at this client. His cloud password had already been reset earlier the same day (`lastPasswordChangeDateTime: 2026-07-09T20:33:05Z`), which could not have fixed a machine login. + +The wiki described Sif-oidak as a hybrid AD/M365 environment. That was verified false: neither SIF-SERVER nor SIF-SERVER2 has an `ADSync` service or an Azure AD Connect uninstall entry, no AD object carries an `msDS-ConsistencyGuid`, and every M365 user has `onPremisesSyncEnabled: null`. The two directories are fully disjoint. jalbert's AD UPN is `jalbert@SifOidak.local` while his M365 UPN is `jalbert.sod@sifoidak.onmicrosoft.com` — unrelated accounts belonging to the same person. + +On Howard's instruction, AD user `dortega` was created on SIF-SERVER via GuruRMM `-EncodedCommand` dispatch, matching the client's existing conventions. The account was verified enabled with `pwdLastSet=0` (must change password at next logon) and confirmed replicated to both DCs. In the course of that verification SIF-SERVER2 was confirmed as a **backup domain controller** (`DomainRole: 4`), closing an open question outstanding since May. The temp credential was vaulted and pushed. + +A second issue was then raised: jalbert getting an error adding the "#740 sharp ud3" printer. The `#740` turned out to be the error code, not part of the printer name. Error 740 is `ERROR_ELEVATION_REQUIRED`, matching `Error code= 800702e4` (`0x2E4` = 740) in three PrintService/Admin event-600 entries. Root cause is the post-KB5005652 default `RestrictDriverInstallationToAdministrators=1`, which blocks non-admin print-driver installs via Point and Print; jalbert is not a local admin. Howard confirmed the UAC prompt for the driver install never surfaced, so it presented as a bare error. Howard installed the printer himself; no remote change was dispatched. + +Finally, Mike's standing instruction was captured: new Sif-oidak users must get both an AD account and an M365 account. The related request to drop `onmicrosoft.com` from usernames was investigated and closed as not actionable — the tenant's only verified domain is `sifoidak.onmicrosoft.com`, and using `@sifoidak.com` would require a DNS TXT verification record at GoDaddy, where ACG has no registrar access (Mike confirmed). + +## Key Decisions + +- **Created the AD account rather than resetting the cloud password again.** The cloud password had already been reset that day to no effect. Machine sign-in at this client is AD-only; no M365 change could ever fix it. +- **Placed dortega in `Domain Users` only.** jalbert is also in `AssistancePrograms Group`, but that is a departmental group and membership was not assumed. Flagged for confirmation. +- **Declined to set `RestrictDriverInstallationToAdministrators=0`** as a printer fix. That re-opens the PrintNightmare (CVE-2021-34527) RCE class for every user on the machine. The safe non-interactive alternative (per-machine connection added as SYSTEM via `printui /ga`) was prepared but not dispatched — Howard fixed it manually first. +- **Recorded the UPN rename as DECIDED, not BLOCKED.** Framing it as blocked would invite a future session to re-propose it. It is closed pending registrar access that we are not pursuing. +- **Corrected the wiki's "hybrid" description.** That single wrong word is what makes the two-account trap easy to fall into, and it directly caused this ticket. + +## Problems Encountered + +- **`get-token.sh` resolved `identity.json` from `$HOME`** instead of the repo, dying with `vault_path not set`. Worked around with `export VAULT_ROOT_ENV=D:/vault`. Logged to errorlog as friction. +- **UNC path `\\SIF-SERVER\print$` collapsed to a single backslash** inside a `jq --arg` PowerShell payload, producing a bogus "path not found" that nearly read as a real diagnostic finding. Re-dispatched byte-exact via `ps-encoded.sh`. Logged to errorlog as friction (ref `feedback_windows_quote_stripping`). +- **A rejected `git push` reported `[OK]`.** The chain `git push -q 2>&1 | tail -5 && echo "[OK]"` tested `tail`'s exit status, not git's. The vault push had actually been rejected (remote ahead). Fixed with `git pull --rebase` then a bare `git push`. Logged to errorlog as friction. +- **`signInActivity` query returned 403** — `AuditLog.Read.All` is still missing on the Security Investigator SP for this tenant, so sign-in history could not be read. This is the known open item from 2026-06-03, re-confirmed still outstanding. +- **Laptop agent UUIDs in the wiki were stale** — both laptops had re-enrolled since May. Corrected, with a warning to always resolve hostname → UUID live. + +## Configuration Changes + +| File | Change | +|---|---| +| `wiki/clients/sif-oidak.md` | Rewrote identity model (not hybrid); added Identity model, Printing, and User Onboarding Runbook sections; corrected agent UUIDs; confirmed SIF-SERVER2 as backup DC; closed UPN item; two history entries | +| `D:/vault/clients/sif-oidak/ad-users.sops.yaml` | **Created** — dortega AD credential (SOPS-encrypted, pushed) | +| `errorlog.md` | 3 `--friction` entries (get-token identity resolution, UNC backslash mangling, piped-exit-code false OK) | + +**AD change (SIF-SERVER):** created user `dortega`. + +## Credentials & Secrets + +- **`dortega` on-prem AD account** — vaulted at `clients/sif-oidak/ad-users.sops.yaml`. Temp password is single-use: `pwdLastSet=0` forces a change at first logon, invalidating it. Read with: + ```bash + bash .claude/scripts/vault.sh get-field clients/sif-oidak/ad-users.sops.yaml credentials.dortega_temp_password + ``` +- Password was never pasted into chat, a ticket, or a commit message. +- **ACG has no GoDaddy/registrar credentials for `sifoidak.com`.** Confirmed absent from vault; Mike confirmed we cannot obtain them. +- Existing: `clients/sif-oidak/laptops.sops.yaml` holds `Localadmin` / `Sif` local creds for the laptops. + +## Infrastructure & Servers + +| Host | Role | GuruRMM agent ID | Notes | +|---|---|---|---| +| SIF-SERVER | **PDC** (`DomainRole: 5`) | `def9fdbb-020b-498d-9d3b-edf5912ba298` | Shares SHARP UD3 PCL6 + MX-6070V PCL6 | +| SIF-SERVER2 | **Backup DC** (`DomainRole: 4`, confirmed this session) | `944b0c4b-048d-44b8-85e5-40da135f58d6` | Shares SHARP MX-6240N PCL6 | +| Sif-Laptop554 | jalbert's laptop | `9e5016f0-e330-4d24-ab01-67cf4e55d46b` | Online; UUID changed since May | +| Sif-Laptop555 | likely Ortega's (unconfirmed) | `1be314d5-0395-4b1c-aa26-3b4a96bd2e22` | Offline; UUID changed since May | + +- **AD domain:** `SifOidak.local` — 71 users. Only UPN suffix in the forest. +- **AD password policy:** `MinPasswordLength: 6`, `ComplexityEnabled: False`, `MaxPasswordAge: ~42d`. +- **M365 tenant:** `sifoidak.onmicrosoft.com`, tenant ID `568eb763-3b95-4271-8443-530c74b1c6bb`. + - Only verified domain: `sifoidak.onmicrosoft.com` (`isInitial`, `isDefault`). + - SKU `O365_BUSINESS`, 11/11 consumed. Service plans include `EXCHANGE_S_FOUNDATION` (no-mailbox stub), `OFFICE_BUSINESS`, `ONEDRIVESTANDARD`. + - **No Exchange mailboxes exist.** All 12 users: `mail: null`, zero `proxyAddresses`. +- **Email:** `sifoidak.com` at **GoDaddy** — `NS ns19/ns20.domaincontrol.com`, `MX 0 smtp.secureserver.net`, `MX 10 mailstore1.secureserver.net`. Outside M365 entirely. +- **Printers:** all three queues use `PortName 192.168.0.99`. +- Parent org `tonation-nsn.gov` has `MX -> tonationnsn-gov02b.mail.protection.outlook.com` (separate tenant, not ours). + +## Commands & Outputs + +Find the client's agents: +```bash +bash .claude/scripts/rmm-search.sh -c "sif-oidak" +``` + +Confirm no AD account existed (returned zero matches across 71 users): +```powershell +Get-ADUser -Filter { Name -like "*ortega*" -or SamAccountName -like "*ortega*" } -Properties Enabled,LockedOut +``` + +Confirm no directory sync (all three checks negative on both DCs): +```powershell +Get-Service -Name "ADSync","AzureADConnectHealthSync*" # none +Get-ItemProperty HKLM:\...\Uninstall\* | ? DisplayName -match "Azure AD Connect" # none +(Get-ADUser -Filter * -Properties "msDS-ConsistencyGuid" | ? {$_."msDS-ConsistencyGuid"}).Count # 0 +``` + +Workstation join state (Sif-Laptop554): +``` +AzureAdJoined : NO +DomainJoined : YES +``` + +Create the account (dispatched byte-exact via `ps-encoded.sh` because of the `!` and quotes): +```bash +bash .claude/scripts/ps-encoded.sh rmm def9fdbb-020b-498d-9d3b-edf5912ba298 create-dortega.ps1 --timeout 120 +``` +Result — `cmd:cb79dca7`, exit 0: +``` +SamAccountName : dortega +UserPrincipalName : dortega@SifOidak.local +DistinguishedName : CN=Dwayne Ortega,OU=Domain Users,DC=SifOidak,DC=local +Enabled : True +pwdLastSet : 0 <- must change at next logon +MUSTCHANGE=True +``` +Replication verified on both DCs (`Get-ADUser dortega -Server localhost` → visible, `pwdLastSet=0`). + +Printer failure — `Microsoft-Windows-PrintService/Admin`, event 600, ×3 on 2026-07-09: +``` +The print spooler failed to import the printer driver that was downloaded from +\\sif-server\print$\x64\PCC\sv0emenu.inf_amd64_d930f97fabc69575.cab into the driver +store for driver SHARP UD3 PCL6. Error code= 800702e4. +``` +`0x800702e4` → Win32 error `0x2E4` = **740** = `ERROR_ELEVATION_REQUIRED`. The event text blames the digital signature — **red herring**, it is purely elevation. + +```powershell +# absent -> Windows default = 1 = only admins may install printer drivers +(Get-ItemProperty "HKLM:\Software\Policies\Microsoft\Windows NT\Printers" -Name RestrictDriverInstallationToAdministrators).RestrictDriverInstallationToAdministrators +# ABSENT + +Get-LocalGroupMember Administrators +# SIF-LAPTOP554\Administrator, SIF-LAPTOP554\Localadmin, SIFOIDAK\Domain Admins (no jalbert) +``` + +Separate GPO defect — event 513 on Sif-Laptop554: +``` +Group Policy was unable to add per computer connection \\SIF-SERVER\SHARP MX-6240N PCL6. +Error code 0x709. +``` +The MX-6240N is shared on **SIF-SERVER2**, not SIF-SERVER. GPO path is wrong. + +Graph reads (note the `VAULT_ROOT_ENV` workaround): +```bash +export VAULT_ROOT_ENV="D:/vault" +TOK=$(bash ~/.claude/skills/remediation-tool/scripts/get-token.sh sifoidak.onmicrosoft.com investigator | tail -1) +curl -s "https://graph.microsoft.com/v1.0/domains" -H "Authorization: Bearer $TOK" +curl -s "https://graph.microsoft.com/v1.0/subscribedSkus" -H "Authorization: Bearer $TOK" +``` + +## Pending / Incomplete Tasks + +- [ ] **Confirm which laptop is Ortega's** (Sif-Laptop555 assumed; offline this session) and verify he can sign in and complete the forced password change. He must be on the domain network for the first logon. +- [ ] **Fix the GPO printer path** — `\\SIF-SERVER\SHARP MX-6240N PCL6` → `\\SIF-SERVER2\SHARP MX-6240N PCL6`. Failing on every boot today. +- [ ] **Backfill `AuditLog.Read.All` + `User.Read.All`** on the Security Investigator SP: `onboard-tenant.sh sifoidak.onmicrosoft.com`. Sign-in history unreadable until then. Open since 2026-06-03. +- [ ] Decide whether dortega needs `AssistancePrograms Group` membership. +- [ ] Consider hardening the AD password policy (min 6, complexity off). +- [ ] Determine if jalbert's `PasswordNeverExpires` should be restored (cleared 2026-05-28). +- [ ] Consider GDAP / Partner Center relationship to get the tenant into CIPP. +- [ ] **No Syncro ticket or time was logged for this session.** Billing rate is $150/hr remote. +- [x] ~~Remove `onmicrosoft.com` from M365 usernames~~ — **CLOSED.** No registrar access to `sifoidak.com`; Mike confirmed unobtainable. Do not re-open. + +## Reference Information + +- Wiki article: `wiki/clients/sif-oidak.md` +- Commits: `2b6e368` (identity model + printer + onboarding runbook), `e570629` (close UPN rename) +- Vault: `clients/sif-oidak/ad-users.sops.yaml`, `clients/sif-oidak/laptops.sops.yaml` +- GuruRMM command IDs: `cb79dca7` (create dortega), `d72cee82` (AD user search) +- Syncro customer ID `7694718`; prior tickets #32341, #32380 +- Tenant admin consent URL: `https://login.microsoftonline.com/sifoidak.onmicrosoft.com/adminconsent?client_id=709e6eed-0711-4875-9c44-2d3518c47063&redirect_uri=https://azcomputerguru.com&prompt=consent` +- Error 740 background: KB5005652 / CVE-2021-34527 (PrintNightmare) Point-and-Print hardening diff --git a/errorlog.md b/errorlog.md index fa34a670..12ee6078 100644 --- a/errorlog.md +++ b/errorlog.md @@ -19,6 +19,10 @@ Categories (the `[type]` tag): _(none)_ = skill/command execution failure · +2026-07-10 | Howard-Home | unifi-wifi/gw-sitemanager.sh | [friction] net raw truncates JSON at [:5000] chars, so /stat/sta output is unparseable for sites with >~10 clients; had to re-query api.ui.com directly with the vaulted key [ctx: script=gw-sitemanager.sh line=264 workaround=direct-curl] + +2026-07-10 | Howard-Home | unifi-wifi/gw-sitemanager | Site Manager API call failed (HTTP 404) [ctx: path=/v1/connector/consoles/1C6A1B1BC2470000000008B8D1B50000000009302B160000000067A67E3A:1341833834/proxy/network/stat/sta] + 2026-07-09 | GURU-BEAST-ROG | remediation-tool | reset-password.sh JIT cleanup failed: SP cannot remove its own PAA role assignment (Graph 400 self-removal block); required temp PRA grant to second SP to remove. Script should delegate cleanup to another SP or warn [ctx: tenant=sifoidak script=reset-password.sh] 2026-07-09 | GURU-BEAST-ROG | remediation-tool | reset-password: failed to remove JIT Privileged Auth Admin role - standing privilege left behind, REMOVE MANUALLY [ctx: tenant=568eb763-3b95-4271-8443-530c74b1c6bb assignment=ikzke6-tKk6E1qsmSeCKE7PwwTzAbMNNrIysDtlMU0E-1 http=400] diff --git a/wiki/clients/cascades-tucson.md b/wiki/clients/cascades-tucson.md index 23f2bbec..6a7d703b 100644 --- a/wiki/clients/cascades-tucson.md +++ b/wiki/clients/cascades-tucson.md @@ -211,7 +211,7 @@ Because per-user **Intune** never provisioned tenant-wide (`INTUNE_A = PendingIn - Sharon Edwards -- Life Enrichment Assistant (DESKTOP-DLTAGOI) - Ashley Jensen -- Accountant (DESKTOP-U2DHAP0) - Shelby Trozzi -- MemCare Director (MDIRECTOR-PC) - - Chris Knight -- Accounting / Business Office (same access tier as Lauren Hasselman); chris.knight@cascadestucson.com (alias: c.knight@cascadestucson.com). **Workstation setup 2026-06-08:** machine **DESKTOP-N5G1ROO** (Win 11 Pro for Workstations) domain-joined + GuruRMM-enrolled (agent `205025ee-2676-4498-8a27-e88562a6f69a`), Office installed. AD account `chris.knight` (OU=Administrative) finished to match Lauren. Mailbox remains cloud-only/unsynced (same split state as Lauren). + - Chris Knight -- Accounting / Business Office (same access tier as Lauren Hasselman); chris.knight@cascadestucson.com (alias: c.knight@cascadestucson.com). **Workstation setup 2026-06-08:** machine **DESKTOP-N5G1ROO** (Win 11 Pro for Workstations) domain-joined + GuruRMM-enrolled (agent `205025ee-2676-4498-8a27-e88562a6f69a`), Office installed. AD account `chris.knight` (OU=Administrative) finished to match Lauren. Mailbox remains cloud-only/unsynced (same split state as Lauren). **Accounting mailbox access 2026-07-09:** granted FullAccess (auto-mapping) + SendAs on `accounting@cascadestucson.com`, matching Lauren/Ashley/Zachary. - JD Martin -- Syncro-confirmed contact (jd.martin@cascadestucson.com); Chef's Office user on CHEF-PC (his default printer = USB Chef Printer). - Lupe Sanchez -- staff (DESKTOP-TRCIEJA). EOL workstation (Gateway ZX6971 AIO, i3-2120, 8 GB RAM, Win11 unsupported). **Decision 2026-06-18: replace machine** (dual-AV + EOL hardware causing slow Excel; no remediation on current box). GuruRMM agent `c9bf1a2d-bfdc-401e-9cc8-f9e90bb19587` (resolve live by hostname; UUIDs change on re-enroll). - Tamra Matthews -- Move-In Coordinator (Marketing/Sales), SALES4-PC. **OFFBOARDED 2026-06-30** (left June 2026 -- see Access section). @@ -288,6 +288,8 @@ Because per-user **Intune** never provisioned tenant-wide (`INTUNE_A = PendingIn - **Inky:** No Inky deployment exists in this tenant. Confirmed 2026-06-04. - **EXO MSP app auth note (2026-06-04):** When the MSP app cert is not in the Windows cert store, use client_credentials flow to obtain an EXO-scoped access token and connect via `Connect-ExchangeOnline -AccessToken`. App: ComputerGuru Exchange Operator (`b43e7342-5b4b-492f-890f-bb5a4f7f40e9`). Vault: `msp-tools/computerguru-exchange-operator.sops.yaml`. - **Shared mailboxes (created 2026-06-12):** `grievances@cascadestucson.com` and `Surveys@cascadestucson.com` -- both SharedMailbox type, cloud-only, no license consumed. Delegated to Meredith Kuhn and Ashley Jensen with FullAccess (auto-mapping) + SendAs on each. All 8 permission grants verified. Ticket #32417. +- **`accounting@cascadestucson.com` ("Accounting Dept.")** -- SharedMailbox, cloud-only, account disabled (normal for shared). **Delegates (verified 2026-07-09): Lauren Hasselman, Ashley Jensen, Zachary Nelson, Chris Knight** -- each holds FullAccess (auto-mapping) + SendAs. Chris Knight added 2026-07-09 to match Lauren's tier. Note `accountingassistant@` is a separate **UserMailbox**, not a delegate of this one. + - **Grant pattern (EXO REST `InvokeCommand`, `exchange-op` tier):** `Add-MailboxPermission -Identity accounting@ -User -AccessRights FullAccess -InheritanceType All -AutoMapping $true`, then `Add-RecipientPermission -Identity accounting@ -Trustee -AccessRights SendAs`. AutoMapping is what makes the mailbox self-attach in the user's Outlook profile (AutoDiscover refresh; restart Outlook to force). **Verification gotcha:** an immediate `Get-RecipientPermission` read-back can miss the new SendAs trustee (replication lag across EXO replicas) -- re-read before concluding the write failed. SendAs itself can take ~60 min to replicate before sending stops bouncing. ### Network